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VERSION WITH MARKINGS TO SHOW CHANGES MADE 
IN THE SPECIFICATION: 

Paragraph starting on page 14, line 19, to page 15, line 3, has been amended as follows: 
(C) Model Checker 

Logical model checking can be performed using the SPIN model checker. SPIN verification 
models can define the behavior of systems of asynchronous processes that interact by synchronous 
or asynchronous message passing, or by shared access to global data. SPIN converts the input 
specification into a product of automata. The global behavior defined by this product can be checked 
efficiently for a wide range of correctness properties using an automata theoretic model checking 
procedure. More information on the [automate ] automata - theoretic approach to formal verification 
can be found in: Gerard J. Holzmann, The model checker Spin\ IEEE Trans. On Software 
Engineering, Vol. 23, No. 5, May 1997, pp. 279-295, and in: Vardi and Wolper, An Automata- 
theoretic Approach to Automatic Program Verification, Proc. Symp. on Logic in Computer Science, 
pp. [322-3311332^344, Cambridge, June 1986. 



